cymmetria/mtpot

Open Source Telnet Honeypot

mtpot's Issues

Another telnetsrv issue

When trying to run the script, I'm getting

c:\Work\MTPot>MTPot.py -v mirai_conf.json
Traceback (most recent call last):
  File "C:\Work\MTPot\MTPot.py", line 6, in <module>
    from telnetsrv.green import TelnetHandler, command
  File "C:\Python\lib\site-packages\telnetsrv\green.py", line 6, in <module>
    from telnetsrvlib import TelnetHandlerBase, command
  File "C:\Python\lib\site-packages\telnetsrv\telnetsrvlib.py", line 29, in <module>
    import curses.ascii
  File "C:\Python\lib\curses\__init__.py", line 15, in <module>
    from _curses import *
ImportError: No module named _curses

Has this script ever been tested on a Windows machine? I realize that it's not your fault that the author(s) of telnetsrv seem to think that the whole world is Linux, but perhaps you could contact them and suggest them to resort to wcurses on Windows machines or something?

suggested configuration additions

to capture other variants:

    "MIRAI": "MIRAI: applet not found",
    "DONGS": "DONGS: applet not found",
    "MEMES": "MEMES: applet not found",
"THTC":  "THTC: applet not found",

Missing response to "cat /bin/echo" command

The Mirai scanners run the command "cat /bin/echo" in order to determine system architecture, after which the scanner will run a wget command to fetch the mirai malware.

The following response is sufficient to trigger the wget command: '\x7fELF\x01\x01\x01\x03\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08\x00\x00\x00\x00\x00'

Unfortunately, this string can't be included in the json "commands", since it includes control characters. If you would like to include this functionality, and have an idea for how to include it, I will put it in a pull request. In my local branch I just added a special check for this inside get_busybox_response(), but that is kind of a hacky/ugly solution.

gevent/telnetsrv error

getting this error after a connection/login is received

Traceback (most recent call last):
File "/usr/lib/python2.7/dist-packages/gevent/greenlet.py", line 327, in run
result = self._run(*self.args, **self.kwargs)
File "/usr/local/lib/python2.7/dist-packages/telnetsrv/telnetsrvlib.py", line 821, in inputcooker
c2 = self._inputcooker_getc(block=False)
File "/usr/local/lib/python2.7/dist-packages/telnetsrv/telnetsrvlib.py", line 774, in _inputcooker_getc
if not self.inputcooker_socket_ready():
File "/usr/local/lib/python2.7/dist-packages/telnetsrv/green.py", line 44, in inputcooker_socket_ready
return gevent.select.select([self.sock.fileno()], [], [], 0) != ([], [], [])
AttributeError: 'module' object has no attribute 'select'
<Greenlet at 0x76600080: <bound method MyTelnetHandler.inputcooker of <main.MyTelnetHandler instance at 0x765f5e68>>> failed with AttributeError

Suppress error transmission to connecting hosts.

When connecting. If you send a built in command or trigger an error, it will send the python error to the connecting host.

Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Username:
Password:
welcome

dir
ps faux
ls
help
Help on built in commands

Traceback (most recent call last):
File "/usr/local/lib/python2.7/dist-packages/telnetsrv/telnetsrvlib.py", line 992, in handle
self.COMMANDScmd
File "/usr/local/lib/python2.7/dist-packages/telnetsrv/telnetsrvlib.py", line 910, in cmdHELP
doc = method.doc.split("\n")
AttributeError: 'NoneType' object has no attribute 'split'

Connection closed by foreign host.

Connections hang about in CLOSE_WAIT state

I'm seeing every(?) connection hang about in a CLOSE_WAIT state and they never seem to fully close.

After a few hours MTPot needs restarted as it runs out of FDs. Example output below:

netstat -pn |grep 15439 | grep CLOSE_WAIT |wc -l
234

(15439 is the MTPot PID)